Vulnerability in Linux Kernel Affecting AH6 Routing Header Validation

CVE-2026-80844

What is CVE-2026-80844?

A flaw exists within the Linux kernel's AH6 module related to the validation of routing header segments. The function ipv6_rearrange_rthdr() improperly assumes that the 'segments_left' field of a routing header will not exceed the number of addresses defined in the hdrlen field. However, this holds true only for certain packet types, which can lead to serious issues when processing raw IPv6 HDRINCL packets. Specifically, a scenario where 'hdrlen' is set to 2 may trigger 'segments_left' to be an arbitrary value, such as 255. This results in the address pointer being moved backwards by an alarming 4,064 bytes, leading to potential memory corruption and an out-of-bounds access issue. It is crucial for developers to validate this invariant locally and ensure that malformed-header errors are properly processed in accordance with existing AH6 input and output error paths.

References